search

adorsys / keycloak-config-cli

Import YAML/JSON-formatted configuration files into Keycloak - Configuration as Code for Keycloak.
Apache License 2.0
759 stars 136 forks source link

Changing a username while keeping the email unchanged leads to 409 conflict #662

Open tobilarscheid opened 2 years ago

tobilarscheid commented 2 years ago

Current Behavior

  1. Create a realm.yaml that contains a user with a name and an email address
  2. Run keycloak-config-cli to apply the realm.yaml
  3. Change the realm.yaml so that the user's email stays the same but the username is changed
  4. Rerun keycloak-config-cli --> error, 409 Conflict

Expected Behavior

A new user with the new name should be created, the old user should disappear

Steps To Reproduce

No response

Environment

Anything else?

No response

jkroepke commented 2 years ago

Deleting users is currently not implemented in keycloak-config-cli, only create and update.

Thats why keycloak-config-cli will not delete the old user and the new user has a conflict with the existing user.

tobilarscheid commented 2 years ago

I understand, thanks for the quick reply! Happy to provide a PR if you point me in the right direction.

jkroepke commented 2 years ago

For deleting users, a remote state needs to be implement. Otherwise, Keycloak-config-cli is going to delete all users which is a major incident.

More informations here: https://github.com/adorsys/keycloak-config-cli/blob/main/docs/MANAGED.md

Take a look, how Realm Roles are handled on deletion.

https://github.com/adorsys/keycloak-config-cli/blob/1a22b22462b95ac96a5ea14cd3d4ea1f801d5568/src/main/java/de/adorsys/keycloak/config/service/RoleImportService.java#L243-L269

github-actions[bot] commented 2 years ago

This issue is stale because it has been open 30 days with no activity. Remove stale label or comment or this will be closed in 5 days.

testuser7 commented 2 years ago

Is there any plan to add the remote state feature?

tobilarscheid commented 2 years ago

Hi @testuser7 (what a name ;-) ), I haven't looked into it so far!